I Wanna Go Fast, Really Fast, like (Kerberos) FAST

Executive summary: This blog details the author's lab deployment and testing of Kerberos FAST (Flexible Authentication Secure Tunneling), covering GPO settings, packet-observed differences in AS/TGS flows, and practical testing with offensive security tools (Rubeus and Impacket). The author found that with FAST enforced, many non-LSASS tool workflows fail with KDC_ERR_POLICY while LSASS-backed techniques may still succeed, and notes implementation challenges and operational trade-offs when enabling FAST.